{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T20:48:06Z","timestamp":1775162886940,"version":"3.50.1"},"reference-count":46,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U24B20147"],"award-info":[{"award-number":["U24B20147"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3678359","type":"journal-article","created":{"date-parts":[[2026,3,27]],"date-time":"2026-03-27T19:49:12Z","timestamp":1774640952000},"page":"3339-3352","source":"Crossref","is-referenced-by-count":0,"title":["One Trigger, Multiple Victims: Clean-Label Neighborhood Backdoor Attacks on Graph Neural Networks"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-9643-7542","authenticated-orcid":false,"given":"Huaxin","family":"Deng","sequence":"first","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, Sichuan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0708-1686","authenticated-orcid":false,"given":"Yong","family":"Fang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, Sichuan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiang","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, Sichuan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1175-2753","authenticated-orcid":false,"given":"Chengwei","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Cryptology and Cyber Science, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7300-9215","authenticated-orcid":false,"given":"Yang","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2843-4225","authenticated-orcid":false,"given":"Yijia","family":"Xu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, Sichuan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539415"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657721"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403117"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-022-00447-x"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463560"},{"key":"ref6","first-page":"1523","article-title":"Graph backdoor","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Xi"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2025.107726"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2024.106668"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583392"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671910"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2024.112433"},{"key":"ref12","first-page":"24","article-title":"PERCBA: Persistent clean-label backdoor attacks on semi-supervised graph node classification","volume-title":"Proc. AISafety\/SafeRL@ IJCAI","author":"Yang"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/INNOVATIONS.2018.8605995"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3696410.3714665"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/s40747-023-01200-6"},{"key":"ref16","article-title":"Transaction fraud detection via an adaptive graph neural network","author":"Tian","year":"2023","journal-title":"arXiv:2307.05633"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom50675.2020.00121"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645486"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.039"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3411977"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1609.02907"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467364"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3488560.3498408"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-024-1510-8"},{"key":"ref25","first-page":"1024","article-title":"Inductive representation learning on large graphs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Hamilton"},{"key":"ref26","article-title":"Graph attention networks","author":"Veli\u010dkovi\u0107","year":"2017","journal-title":"arXiv:1710.10903"},{"key":"ref27","article-title":"How powerful are graph neural networks?","author":"Xu","year":"2018","journal-title":"arXiv:1810.00826"},{"key":"ref28","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN54540.2023.10191949"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2025.3543020"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2024.110449"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3563531"},{"key":"ref35","first-page":"90891","article-title":"On provable privacy vulnerabilities of graph representations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref36","article-title":"Graph neural backdoor: Fundamentals, methodologies, applications, and future directions","author":"Yang","year":"2024","journal-title":"arXiv:2406.10573"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240798"},{"issue":"406","key":"ref38","first-page":"1","article-title":"Convergence of message-passing graph neural networks with generic aggregation on large random graphs","volume":"25","author":"Cordonnier","year":"2024","journal-title":"J. Mach. Learn. Res."},{"key":"ref39","first-page":"1568","article-title":"Bilevel programming for hyperparameter optimization and meta-learning","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"80","author":"Franceschi"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1023\/A:1009953814988"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1609\/aimag.v29i3.2157"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/1401890.1402008"},{"key":"ref43","article-title":"GraphSAINT: Graph sampling based inductive learning method","author":"Zeng","year":"2019","journal-title":"arXiv:1907.04931"},{"key":"ref44","first-page":"83136","article-title":"Robustness inspired graph backdoor defense","volume-title":"Proc. 13th Int. Conf. Learn. Representations","author":"Zhang"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26318"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.21428\/594757db.d853176e"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11457041.pdf?arnumber=11457041","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T19:49:04Z","timestamp":1775159344000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11457041\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":46,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3678359","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}